@rightkit/release 0.6.12 → 0.6.14

package/qa-journeys-prebuilt.mjs

@@ -0,0 +1,148 @@
+// GB-79 (GATE test stage E1/E6/E11): `rightkit-qa journeys run` on a snapshot stage, as the gate's own build-once route (capability `journeys-prebuilt-input`).
+//
+// `journeys run` spawns its own `rustright cargo ... --no-run`, which a gate-carried stage cannot allow: a snapshot stage compiles once, in the carrier, and QA runs
+// an already-built, already-signed product outside the broker. So the gate takes the build out of QA's hands:
+//   1. ask QA what it would build, without building (`journeys run ... --print-build-plan`: the declared build command and each artifact role's marker policy);
+//   2. carry that build (`cargo test ... --no-run --message-format=json`) through the carrier: one signed, ledgered broker request, its receipt verified;
+//   3. have QA name the executable each role resolves to in the carried listing (`--print-build-plan --from-cargo-json <listing>`), and check each lies inside the
+//      receipt's verified output directory;
+//   4. sign every product (a role whose marker is required) with the product's one identity (suite-signing.mjs runSignStep), outside the broker, from the receipt's
+//      output directory; a product that cannot be signed refuses and nothing launches;
+//   5. write the attestation (`rightkit.journeys.prebuilt-input/1`: the broker request id and digest, the listing's sha256, the carried command, the sha256 of
+//      every executable QA will launch) and run QA directly with `--from-cargo-json <listing> --prebuilt-attestation <file>`, the signing evidence in its environment.
+// QA verifies all of it again (crates/rightkit-qa/src/journeys/prebuilt.rs build_from_prebuilt) and never compiles. An empty journey set is never green: the plan
+// step fails when nothing is selected, QA's own verdict needs executed journeys, and an empty listing is refused on both sides.
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import crypto from "node:crypto";
+import { spawnSync } from "./background-process.mjs";
+import { runCarriedCargo } from "./carried-cargo.mjs";
+import { isInside, realish } from "./qa-snapshot.mjs";
+import { runSignStep } from "./suite-signing.mjs";
+import { QA_APP_BINARY_ENV, QA_SIGNED_FILES_ENV, QA_SIGNING_EVIDENCE_ENV } from "./suite-signing-policy.mjs";
+
+export const JOURNEYS_PREBUILT_CAPABILITY = "journeys-prebuilt-input";
+export const PREBUILT_SCHEMA = "rightkit.journeys.prebuilt-input/1";
+export const BUILD_PLAN_SCHEMA = "rightkit.journeys.build-plan/1";
+/** The suite name the sign step reads the carried receipt's output directory under. */
+export const JOURNEYS_BUILD_SUITE = "journeys-build";
+/** The exact key set of the attestation (QA reads it with unknown fields denied). */
+export const ATTESTATION_KEYS = Object.freeze(["schema", "request_id", "request_sha256", "listing_sha256", "command", "outputs"]);
+
+const sha256 = (data) => createHash("sha256").update(data).digest("hex");
+const words = (args) => args.map(String);
+const OWN_FLAGS = ["--from-cargo-json", "--prebuilt-attestation", "--print-build-plan"];
+const flagOf = (w) => { const at = w.indexOf("="); return at > 0 && w.startsWith("--") ? w.slice(0, at) : w; };
+
+/** True when this QA argv is `journeys run ...`. */
+export const isJourneysRun = (args) => { const w = words(args); return w[0] === "journeys" && w[1] === "run"; };
+
+/** Why a `journeys run` argv cannot be carried, or null: the listing and attestation are the gate's to write, never the step's (an input the gate did not verify). */
+export function journeysRunRefusal(args) {
+  const own = words(args).filter((w) => w.startsWith("-")).map(flagOf);
+  const named = OWN_FLAGS.find((flag) => own.includes(flag));
+  return named ? `${named} is the gate's own: a journeys step names no listing, attestation or plan flag (the gate carries the build and hands QA the verified input)` : null;
+}
+
+/**
+ * Whether the installed `rightkit-qa` implements the prebuilt journey input: its `journeys run --help` names the capability. A binary that cannot be asked, or does
+ * not name it, has no such mode.
+ */
+export function qaPrebuiltCapability(qa, { spawn = spawnSync, env = process.env } = {}) {
+  try {
+    const r = spawn(qa, ["journeys", "run", "--help"], { encoding: "utf8", env, windowsHide: true, timeout: 20000 });
+    return r?.status === 0 && String(r.stdout ?? "").includes(JOURNEYS_PREBUILT_CAPABILITY);
+  } catch { return false; }
+}
+
+/** The refusal text of a planned journeys step on a snapshot stage whose QA lacks the capability, naming it. */
+export const journeysCapabilityRefusal = (name) => `${name}: \`rightkit-qa journeys run\` needs capability "${JOURNEYS_PREBUILT_CAPABILITY}" and the installed rightkit-qa does not advertise it (\`rightkit-qa journeys run --help\`): without it QA would compile through the broker itself, and a gate-carried stage must build once, sign, then run prebuilt bytes. Nothing ran`;
+
+const fail = (code, message, status = 101) => Object.assign(new Error(`${code}: ${message}`), { code, status });
+
+function parsePlan(result, what) {
+  if (result?.error) throw fail("RK_QA_JOURNEYS_PLAN", `${what}: rightkit-qa did not start (${result.error.message})`);
+  if (result?.status !== 0) throw fail("RK_QA_JOURNEYS_PLAN", `${what}: rightkit-qa exited ${result?.status}: ${String(result?.stderr ?? "").trim().slice(0, 600) || "no message"}; nothing was built`);
+  let plan;
+  try { plan = JSON.parse(String(result.stdout).trim().split(/\r?\n/).filter(Boolean).pop() ?? ""); } catch { throw fail("RK_QA_JOURNEYS_PLAN", `${what}: rightkit-qa printed no build plan`); }
+  if (plan?.schema !== BUILD_PLAN_SCHEMA || !Array.isArray(plan.command) || !Array.isArray(plan.artifacts) || typeof plan.cwd !== "string") throw fail("RK_QA_JOURNEYS_PLAN", `${what}: the build plan is not a ${BUILD_PLAN_SCHEMA} document`);
+  return plan;
+}
+
+/**
+ * The gate's build-once run of one `journeys run` step. `args` is QA's argv (`journeys run ...`); `map` is the carrier map. Resolves `{ status }` (QA's own exit status)
+ * or throws an Error with a typed `code` (nothing ran, or QA was never started). Every effect is injectable: `spawn` (QA), `carry` (the carrier), `signStep`, `loadConfig`.
+ */
+export function runJourneysPrebuilt({ qa, args, cwd = process.cwd(), env = process.env, map, platform = process.platform, spawn = spawnSync, carry = runCarriedCargo, signStep = runSignStep, signDeps = {}, loadConfig = defaultConfig, log = (m) => process.stderr.write(`${m}\n`) }) {
+  const given = words(args);
+  if (!isJourneysRun(given)) throw fail("RK_QA_JOURNEYS_USAGE", `rightkit-qa ${given.join(" ")} is not a journeys run step`);
+  const own = journeysRunRefusal(given);
+  if (own) throw fail("RK_QA_JOURNEYS_FLAG", own);
+  const section = map.broker ?? {};
+  const snapshot = section.snapshot?.path;
+  const checkouts = [section.checkout, env.RK_GATE_CHECKOUT].filter((c) => typeof c === "string" && c);
+  const run = (extra, what) => spawn(qa, [...given, ...extra], { cwd, env, encoding: "utf8", windowsHide: true, maxBuffer: 1 << 26 });
+  // 1. what QA would build (nothing is created or built).
+  const plan = parsePlan(run(["--print-build-plan"]), "the build plan");
+  if (plan.command[0] !== "rustright" || plan.command[1] !== "cargo" || plan.command.length < 3) throw fail("RK_QA_JOURNEYS_PLAN", `the declared build ${JSON.stringify(plan.command)} is not a \`rustright cargo ...\` command; a snapshot stage carries Cargo builds only`);
+  if (plan.artifacts.length === 0) throw fail("RK_QA_JOURNEYS_EMPTY", "the journeys build declares no artifact: an empty journey set is never green");
+  if (!snapshot || !isInside(plan.cwd, snapshot) || checkouts.some((c) => isInside(plan.cwd, c))) throw fail("RK_QA_JOURNEYS_PLACE", `the journeys build directory ${plan.cwd} is not inside the commit's snapshot${snapshot ? ` (${snapshot})` : ""}`);
+  // 2. the carried build.
+  const dir = path.join(path.dirname(map.ledgerDir), "qa-listings");
+  if (isInside(dir, snapshot) || checkouts.some((c) => isInside(dir, c))) throw fail("RK_QA_JOURNEYS_PLACE", `the listing directory ${dir} is inside the snapshot or the primary checkout`);
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const stem = path.join(realish(dir), `${process.pid}-${Date.now().toString(36)}-${crypto.randomBytes(4).toString("hex")}`);
+  const listingFile = `${stem}.jsonl`; const attestationFile = `${stem}.attestation.json`;
+  const cargoWords = plan.command.slice(2);
+  const built = carry(cargoWords, { cwd: plan.cwd, env, stdio: "capture" }, { map });
+  if (built.stderr) process.stderr.write(built.stderr);
+  if (built.error) throw fail("RK_QA_JOURNEYS_BUILD", built.error.message);
+  if (built.status !== 0 || built.refusal || built.outputDir === undefined || !built.requestId || !/^[0-9a-f]{64}$/.test(built.requestDigest ?? "")) {
+    throw Object.assign(fail("RK_QA_JOURNEYS_BUILD", `the carried build \`cargo ${cargoWords.join(" ")}\` did not complete with a verified receipt (exit ${built.status}${built.refusal ? `, ${built.refusal.code}` : ""}); QA did not run`), { status: built.status || 101 });
+  }
+  let signedDir = null;
+  try {
+    const listing = String(built.stdout ?? "");
+    fs.writeFileSync(listingFile, listing, { mode: 0o600 });
+    // 3. the executable of each role, as QA resolves it from this listing; each must be a file the receipt's output directory holds.
+    const resolved = parsePlan(run(["--print-build-plan", "--from-cargo-json", listingFile]), "the role to executable mapping");
+    const roles = resolved.artifacts;
+    const outputs = [];
+    for (const role of roles) {
+      if (typeof role.executable !== "string" || !role.executable) throw fail("RK_QA_JOURNEYS_PLAN", `role ${role.role} resolves to no executable in the carried listing`);
+      const real = realish(role.executable);
+      if (!isInside(real, built.outputDir)) throw fail("RK_QA_JOURNEYS_PLACE", `role ${role.role}: ${role.executable} is not inside the receipt's output directory ${built.outputDir}`);
+      let data;
+      try { if (!fs.statSync(real).isFile()) throw new Error("not a file"); data = fs.readFileSync(real); } catch (e) { throw fail("RK_QA_JOURNEYS_PLACE", `role ${role.role}: ${role.executable} cannot be read (${e.message})`); }
+      outputs.push({ role: role.role, marker: role.marker, path: role.executable, real, sha256: sha256(data) });
+    }
+    if (outputs.length === 0) throw fail("RK_QA_JOURNEYS_EMPTY", "the carried build resolved no executable: an empty journey set is never green");
+    // 4. sign every product before anything launches.
+    let signEnv = {};
+    const products = outputs.filter((o) => o.marker === "required");
+    if (products.length) {
+      let signed;
+      try {
+        const files = products.map((o) => ({ from: JOURNEYS_BUILD_SUITE, path: path.relative(realish(built.outputDir), o.real).split(path.sep).join("/") }));
+        signed = signStep({ name: "journeys-sign", sign: { files }, appRoot: cwd, config: loadConfig(cwd), env, platform, outputDirsOf: (suite) => (suite === JOURNEYS_BUILD_SUITE ? [built.outputDir] : null), deps: signDeps, log });
+      } catch (e) { throw fail(e.code ?? "RK_QA_JOURNEYS_UNSIGNED", `a product of the journeys build could not be signed: ${e.message}; an unsigned product is never launched, and QA did not run`); }
+      signedDir = signed.signedDir;
+      signEnv = { [QA_SIGNING_EVIDENCE_ENV]: signed.evidenceFile, [QA_SIGNED_FILES_ENV]: JSON.stringify(signed.signedFiles ?? {}), ...(signed.appBinary ? { [QA_APP_BINARY_ENV]: signed.appBinary } : {}) };
+    }
+    // 5. the attestation, then QA directly against the verified input.
+    const attestation = { schema: PREBUILT_SCHEMA, request_id: built.requestId, request_sha256: built.requestDigest, listing_sha256: sha256(Buffer.from(listing)), command: [...plan.command.slice(1)], outputs: outputs.map((o) => ({ path: o.path, sha256: o.sha256 })) };
+    fs.writeFileSync(attestationFile, JSON.stringify(attestation), { mode: 0o600 });
+    const ran = spawn(qa, [...given, "--from-cargo-json", listingFile, "--prebuilt-attestation", attestationFile], { cwd, env: { ...env, ...signEnv }, stdio: "inherit", windowsHide: true });
+    if (ran.error) throw fail("RK_QA_JOURNEYS_RUN", ran.error.message);
+    return { status: ran.status ?? 1, attestation };
+  } finally {
+    for (const f of [listingFile, attestationFile]) { try { fs.rmSync(f, { force: true }); } catch { /* pruned with the managed directory */ } }
+    if (signedDir) { try { fs.rmSync(signedDir, { recursive: true, force: true }); } catch { /* the managed root is pruned */ } }
+  }
+}
+
+/** The app's right-release config JSON beside the step's directory (the sign step derives the product identity from it); null when there is none. */
+function defaultConfig(cwd) {
+  try { return JSON.parse(fs.readFileSync(path.join(cwd, "right-release.config.json"), "utf8")); } catch { return null; }
+}

package/qa-snapshot-run.mjs

@@ -0,0 +1,53 @@
+#!/usr/bin/env node
+// `node qa-snapshot-run.mjs <rightkit-qa> -- <qa args>`: one `rightkit-qa run-tests` step of a snapshot stage that would compile, as the two
+// parts the gate can carry (qa-snapshot.mjs). build-launch.mjs hands such a step to this entry instead of refusing it.
+//   (a) the build: the step's test build (`--no-run --message-format=json`) through the carried seam (carried-cargo.mjs runCarriedCargo: one
+//       signed, ledgered broker request from this directory), its stdout written to a listing file under the carrier's managed directory,
+//       which is outside the snapshot and the primary checkout;
+//   (b) the QA step itself, run directly (no broker job: it needs the GUI session and the unscrubbed environment) as the same argv with
+//       `--from-cargo-json <listing>` in place of the build arguments.
+// The step's own environment is this process's environment (the gate's step spawn merged it), so the direct run gets it as declared.
+import fs from "node:fs";
+import path from "node:path";
+import crypto from "node:crypto";
+import { spawnSync } from "./background-process.mjs";
+import { carriedCargoMapOf, runCarriedCargo } from "./carried-cargo.mjs";
+import { isInside, qaSnapshotPlan, realish } from "./qa-snapshot.mjs";
+
+const fail = (message, status = 101) => { process.stderr.write(`rightkit-gate: ${message}\n`); process.exit(status); };
+
+const [qa, separator, ...args] = process.argv.slice(2);
+if (!qa || separator !== "--") fail("RK_QA_SNAPSHOT_USAGE: usage: qa-snapshot-run.mjs <rightkit-qa> -- <args>");
+const carried = carriedCargoMapOf(process.env);
+if (!carried?.map) fail(`RK_QA_SNAPSHOT_CARRIER_MISSING: ${carried?.error ?? "no carried map in the environment"}; a snapshot stage's build is never run around its carrier`);
+const plan = qaSnapshotPlan(args);
+if (!plan) fail(`RK_QA_SNAPSHOT_NO_BUILD: rightkit-qa ${args.join(" ")} compiles nothing and is run directly, not through this entry`);
+if (plan.refusal) fail(`RK_QA_SNAPSHOT_REFUSED: ${plan.refusal}`);
+
+const { map } = carried;
+const section = map.broker ?? {};
+const snapshot = section.snapshot?.path;
+const checkouts = [section.checkout, process.env.RK_GATE_CHECKOUT].filter((c) => typeof c === "string" && c);
+const dir = path.join(path.dirname(map.ledgerDir), "qa-listings");
+if ((snapshot && isInside(dir, snapshot)) || checkouts.some((c) => isInside(dir, c))) fail(`RK_QA_SNAPSHOT_LISTING_PLACE: the listing directory ${dir} is inside the snapshot or the primary checkout`);
+fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+const listing = path.join(realish(dir), `${process.pid}-${Date.now().toString(36)}-${crypto.randomBytes(4).toString("hex")}.jsonl`);
+
+const built = runCarriedCargo(plan.cargoArgs, { cwd: process.cwd(), env: process.env, stdio: "capture" }, { map });
+if (built.stderr) process.stderr.write(built.stderr);
+if (built.error) fail(`RK_QA_SNAPSHOT_BUILD: ${built.error.message}`);
+if (built.status !== 0 || built.refusal || built.outputDir === undefined) {
+  process.stderr.write(`rightkit-gate: RK_QA_SNAPSHOT_BUILD: the carried build \`${plan.cargoArgs.join(" ")}\` did not complete with a verified receipt (exit ${built.status}${built.refusal ? `, ${built.refusal.code}` : ""}); the QA step did not run\n`);
+  process.exit(built.status || 101);
+}
+// The listing is the build's output, not a result: it is removed when the direct QA step ends, whatever its exit code.
+let status;
+try {
+  fs.writeFileSync(listing, built.stdout, { mode: 0o600 });
+  const ran = spawnSync(qa, plan.qaArgs(listing), { cwd: process.cwd(), env: process.env, stdio: "inherit", windowsHide: true });
+  if (ran.error) process.stderr.write(`rightkit-gate: RK_QA_SNAPSHOT_RUN: ${ran.error.message}\n`);
+  status = ran.error ? 101 : ran.status ?? 1;
+} finally {
+  try { fs.rmSync(listing, { force: true }); } catch { /* best effort: the managed directory is pruned with its run */ }
+}
+process.exit(status);

package/qa-snapshot.mjs

@@ -0,0 +1,164 @@
+// The QA step of a snapshot stage (rightkit#1301, rustright#190): what `rightkit-qa <args>` may do, and how a compiling `run-tests` step
+// becomes two parts. QA runs an already-built artifact outside the broker (a GUI session, the unscrubbed environment), so nothing in the
+// step may compile: the gate carries the build itself and then runs QA directly against its listing.
+//
+//   rightkit-qa run-tests --app a -p crate [QA flags] -- <libtest args>
+//     (a) carried:  cargo test -p crate --no-run --message-format=json     stdout -> <listing>   (qa-snapshot-run.mjs)
+//     (b) direct:   rightkit-qa run-tests --app a [QA flags] --from-cargo-json <listing> -- <libtest args>
+//
+// `rightkit-qa journeys run` has no prebuilt form: it spawns `rustright cargo ... --no-run` itself (journeys/build_record.rs spawn_broker)
+// and binds the build to the checkout's HEAD, so a snapshot stage cannot carry that build for it. It stays refused, naming the missing mode.
+//
+// The argument parser of `run-tests` is the Rust CLI's own (crates/rightkit-qa/src/run_tests/cli.rs `parse`): the flags below are its
+// VALUE_FLAGS and BOOL_FLAGS, a flag's value is consumed whatever it looks like, and every other word is a cargo argument.
+import fs from "node:fs";
+import path from "node:path";
+
+/** run-tests flags that take a value (cli.rs VALUE_FLAGS). */
+export const RUN_TESTS_VALUE_FLAGS = Object.freeze(["--root", "--qa-config", "--app", "--managed-root", "--run-id", "--parallel", "--binary-timeout-s", "--total-timeout-s", "--compile-timeout-s", "--env", "--unset-env", "--cwd", "--from-cargo-json", "--build-with", "--receipt"]);
+/** run-tests flags that take none (cli.rs BOOL_FLAGS). */
+export const RUN_TESTS_BOOL_FLAGS = Object.freeze(["--require-broker", "--deny-ignored", "--allow-empty", "--isolate-tmp", "--no-isolate-tmp", "--show-output"]);
+
+/**
+ * Every rightkit-qa option that takes the next word as its value, across its subcommands (run-tests, run, journeys, sweep, ...): the
+ * run-tests list plus the cargo options run-tests forwards and the flags of the binary's own `Args::positionals`. A word that follows one of
+ * these is a value, never a flag.
+ */
+export const QA_VALUE_OPTIONS = new Set([
+  ...RUN_TESTS_VALUE_FLAGS,
+  "--manifest-path", "-p", "--package", "--test", "--features",
+  "--config", "--app-root", "--tier", "--only", "--engine", "--ui-binary", "--backend", "--dir", "--max-gb", "--young-hours", "--kind", "--tree", "--manifest", "--results", "--evidence-root", "--id", "--platform", "--run-store-cap-bytes",
+]);
+
+const splitInline = (word) => {
+  const at = word.indexOf("=");
+  return at > 0 && word.startsWith("--") ? [word.slice(0, at), word.slice(at + 1)] : [word, undefined];
+};
+
+/**
+ * `rightkit-qa run-tests`'s arguments, split exactly as the CLI splits them. `own` is the command's own words in order (flag, and its
+ * value when separate), `cargo` the words that go to `cargo test --no-run`, `testArgs` what follows the first `--` (null when there is none),
+ * `flags` every own flag's values by name. Throws on a value flag with no value (the CLI refuses it too).
+ */
+export function parseRunTests(words) {
+  const own = []; const cargo = []; const flags = new Map();
+  let testArgs = null;
+  for (let i = 0; i < words.length; i += 1) {
+    const arg = words[i];
+    if (arg === "--") { testArgs = words.slice(i + 1); break; }
+    const [name, inline] = splitInline(arg);
+    if (RUN_TESTS_VALUE_FLAGS.includes(name)) {
+      let value = inline;
+      if (value === undefined) {
+        if (i + 1 >= words.length) throw new Error(`${name} needs a value`);
+        i += 1; value = words[i];
+        own.push(arg, value);
+      } else own.push(arg);
+      flags.set(name, [...(flags.get(name) ?? []), value]);
+    } else if (RUN_TESTS_BOOL_FLAGS.includes(name) && inline === undefined) { own.push(arg); flags.set(name, [...(flags.get(name) ?? []), ""]); }
+    else cargo.push(arg);
+  }
+  return { own, cargo, testArgs, flags };
+}
+
+/** The own flags of a non-run-tests QA command (`journeys`, `run`, ...) before `--`, by name, a flag's value consumed so it is never read as a flag. */
+function genericFlags(words) {
+  const flags = new Map();
+  for (let i = 0; i < words.length; i += 1) {
+    const arg = words[i];
+    if (arg === "--") break;
+    const [name, inline] = splitInline(arg);
+    if (QA_VALUE_OPTIONS.has(name)) {
+      let value = inline;
+      if (value === undefined) { i += 1; value = words[i]; }
+      if (value !== undefined) flags.set(name, [...(flags.get(name) ?? []), value]);
+    } else if (arg.startsWith("-")) flags.set(name, [...(flags.get(name) ?? []), ""]);
+  }
+  return flags;
+}
+
+/**
+ * Every value a flag takes anywhere in an argv, `--` included: the Rust `Args` of every command but run-tests reads the WHOLE argv (`has`
+ * is any word equal to the flag, `value` the word after the first one), so nothing is skipped as consumed or as after `--`, and a repeat
+ * (which Rust ignores) is checked too. A trailing flag with no value yields nothing.
+ */
+export function everyValue(words, flag) {
+  const out = [];
+  words.forEach((w, i) => { const [n, inline] = splitInline(w); if (n === flag) { const v = inline ?? words[i + 1]; if (v !== undefined) out.push(v); } });
+  return out;
+}
+
+/** Whether a word is a flag that makes a QA run build (`--build`, `--build-ui`, `--build-with`, each also as `=value`). */
+export const isBuildFlag = (w) => ["--build", "--build-ui", "--build-with"].includes(splitInline(String(w))[0]);
+
+/** The words before the first `--` of an argv. */
+export const ownWords = (words) => (words.includes("--") ? words.slice(0, words.indexOf("--")) : words);
+
+/** Whether a QA argv hands `run-tests` an existing cargo listing, read in flag position only (a value that spells the flag is not the flag). */
+export function hasListing(args) {
+  const words = args.map(String);
+  if (words[0] === "run-tests") { try { return parseRunTests(words.slice(1)).flags.has("--from-cargo-json"); } catch { return false; } }
+  return genericFlags(ownWords(words)).has("--from-cargo-json");
+}
+
+const isMessageFormat = (w) => w === "--message-format" || w.startsWith("--message-format=");
+
+/**
+ * What the gate does with a snapshot stage's `rightkit-qa` step that compiles. `null` when it compiles nothing (or is not run-tests);
+ * `{ cargoArgs, qaArgs }` for a `run-tests` step with no listing: `cargoArgs` is the carried `cargo` argv (`test ... --no-run
+ * --message-format=json`), `qaArgs(listing)` the direct QA argv. `{ refusal }` for a build the gate cannot carry.
+ */
+export function qaSnapshotPlan(args) {
+  const words = args.map(String);
+  if (words[0] !== "run-tests") return null;
+  let parsed;
+  try { parsed = parseRunTests(words.slice(1)); } catch (error) { return { refusal: `rightkit-qa run-tests ${words.slice(1).join(" ")}: ${error.message}` }; }
+  if (parsed.flags.has("--from-cargo-json")) return null;
+  // --root moves the run's root, but the carried build runs from the step's directory: the two would disagree, and neither app uses it.
+  if (parsed.flags.has("--root")) return { code: "RK_QA_SNAPSHOT_ROOT_UNSUPPORTED", refusal: "RK_QA_SNAPSHOT_ROOT_UNSUPPORTED: a carried run-tests build runs from the step's directory, so --root is not supported on a snapshot stage; drop it" };
+  const cargo = parsed.cargo.filter((w) => w !== "--no-run");
+  const formats = cargo.map((w, i) => (w === "--message-format" ? cargo[i + 1] : w.startsWith("--message-format=") ? w.slice("--message-format=".length) : null)).filter((v) => v !== null);
+  if (formats.some((v) => v !== "json")) return { refusal: `rightkit-qa run-tests: a carried build lists its tests as --message-format=json, not ${JSON.stringify(formats.find((v) => v !== "json"))}` };
+  const cargoArgs = ["test", ...cargo, "--no-run", ...(cargo.some(isMessageFormat) ? [] : ["--message-format=json"])];
+  return { cargoArgs, qaArgs: (listing) => ["run-tests", ...parsed.own, "--from-cargo-json", listing, ...(parsed.testArgs === null ? [] : ["--", ...parsed.testArgs])] };
+}
+
+/** `p` resolved as far as it exists (symlinks followed), the rest appended, so a path that does not exist yet still has a real location. */
+export function realish(p) {
+  let current = path.resolve(p); const rest = [];
+  for (;;) {
+    try { return path.join(fs.realpathSync.native(current), ...rest); } catch { /* not there yet */ }
+    const parent = path.dirname(current);
+    if (parent === current) return path.join(current, ...rest);
+    rest.unshift(path.basename(current)); current = parent;
+  }
+}
+export const isInside = (child, parent) => { const rel = path.relative(realish(parent), realish(child)); return rel === "" || !(rel === ".." || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel)); };
+
+/**
+ * Why a QA step's paths are refused on a snapshot stage, or null. The step runs from the commit's snapshot: its working directory must be
+ * inside it, and no input it names (`--from-cargo-json`, `--root`, `--cwd <dir>`, `--manifest-path`) may resolve into the primary checkout
+ * (the gate never reads or runs a working tree). `cwd` is the step's directory; `snapshot` and `checkouts` come from the gate's carried map.
+ */
+export function qaPathReason(args, { cwd, snapshot, checkouts, env = {} }) {
+  const words = args.map(String);
+  const parsedTests = words[0] === "run-tests" ? (() => { try { return parseRunTests(words.slice(1)); } catch { return null; } })() : null;
+  // run-tests has its own parser (own flags before `--`); every other command's Args reads the whole argv, so every value counts.
+  const values = (flag) => (parsedTests ? parsedTests.flags.get(flag) ?? [] : words[0] === "run-tests" ? genericFlags(ownWords(words)).get(flag) ?? [] : everyValue(words, flag));
+  const cwdReal = realish(cwd);
+  if (!snapshot || !isInside(cwdReal, snapshot)) return `its working directory ${cwd} is outside the commit's snapshot${snapshot ? ` (${snapshot})` : ""}`;
+  const roots = values("--root");
+  const named = [];
+  for (const r of roots) named.push(["--root", path.resolve(cwdReal, r)]);
+  const root = path.resolve(cwdReal, roots[0] ?? ".");
+  for (const v of values("--from-cargo-json")) if (v !== "-") named.push(["--from-cargo-json", path.resolve(cwdReal, v)]);
+  for (const flag of ["--qa-config", ...(words[0] === "run-tests" ? [] : ["--app-root", "--config"])]) for (const v of values(flag)) named.push([flag, path.resolve(cwdReal, v)]);
+  if (typeof env.RIGHTKIT_QA_CONFIG === "string" && env.RIGHTKIT_QA_CONFIG) named.push(["RIGHTKIT_QA_CONFIG", path.resolve(cwdReal, env.RIGHTKIT_QA_CONFIG)]);
+  for (const mode of values("--cwd")) if (mode !== "package" && mode !== "workspace") named.push(["--cwd", path.resolve(root, mode)]);
+  const manifests = [];
+  if (parsedTests) parsedTests.cargo.forEach((w, i, all) => { const [name, inline] = splitInline(w); if (name === "--manifest-path") manifests.push(inline ?? all[i + 1]); });
+  else manifests.push(...values("--manifest-path"));
+  for (const m of manifests) if (typeof m === "string" && m) named.push(["--manifest-path", path.resolve(root, m)]);
+  for (const [flag, resolved] of named) for (const checkout of checkouts) if (isInside(resolved, checkout)) return `${flag} resolves to ${resolved}, inside the primary checkout ${checkout}; a snapshot stage's QA step reads only the snapshot and managed output`;
+  return null;
+}

package/qualification-verify.mjs

@@ -0,0 +1,144 @@
+// The verification of a unit qualification's signed broker receipts, in one place for its two callers: the hosted admission
+// (scripts/ci/publish-admission.mjs, inside publish.yml) and the gate's own self-check before it dispatches anything (unit-gate.mjs).
+// It lives in this package, not under scripts/, because unit-gate ships in the package and may import nothing outside it.
+// Pure over the dispatched commit: `git(...args)` reads that commit's objects; nothing here touches the filesystem or the broker.
+import { ProvenanceError, carriedCallNonce, qualificationNonce, verifyProvenance } from "./provenance-verify.mjs";
+import { SnapshotRequestError, ownershipOfHandle, verifySnapshotEvidenceIdentity } from "./snapshot-request.mjs";
+import { assignJobs, describeCommand, expectedStageCommands, rootOfWorkspace } from "./stage-commands.mjs";
+
+export const ATTESTED_STAGES = ["compile", "package"];
+export const MAX_VERIFIED_RECEIPTS = 64;
+const SHA256_HEX = /^[0-9a-f]{64}$/;
+const isRecord = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const sameJson = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+
+const refuse = (message) => { throw new Error(`publication admission refused: ${message}`); };
+const requireThat = (condition, message) => { if (!condition) refuse(message); };
+
+/** The enrolled host pins committed at `sha` (ci/rk-pipeline.json "attestation", one entry per platform) -- never taken from the request. */
+export function enrolledPins(sha, git) {
+  let doc;
+  try { doc = JSON.parse(git("show", `${sha}:ci/rk-pipeline.json`)); } catch { refuse("ci/rk-pipeline.json is unreadable at the dispatched commit; no host is enrolled"); }
+  const pins = Object.entries(doc?.attestation ?? {})
+    .filter(([, p]) => p && typeof p === "object" && ["publicKey", "keyId", "host", "brokerDigest"].every((key) => typeof p[key] === "string" && p[key]))
+    .map(([platform, { publicKey, keyId, host, brokerDigest }]) => ({ publicKey, keyId, host, brokerDigest, platform }));
+  requireThat(pins.length > 0, "ci/rk-pipeline.json enrolls no attestation pins at the dispatched commit");
+  return pins;
+}
+
+/**
+ * The qualification's broker receipts, verified. For each of the compile and package stages: at least one receipt whose signature
+ * verifies against the pins enrolled at the dispatched commit for the receipt's host, whose job id is its own, and whose signed result is
+ * SUCCEEDED with exit code 0. The nonce binds the dispatched commit, its real git tree, the unit and the stage: a carried call (a cargo call, or a pnpm
+ * adapter job) carries the per-call nonce derived from it, the directory it ran in and its argv (carriedCallNonce, rightkit#1301 B8),
+ * checked against the stage row the job is assigned to. A receipt of another commit, tree, unit or stage, or of another
+ * command or directory, cannot carry the nonce. Every receipt also carries signed snapshotEvidence (B9): the commit and tree equal the
+ * dispatched commit's, the snapshot held that tree at start and at exit, and its request id is the job's; all receipts share one snapshot
+ * path and one ownership handle, and, with the stage row's directory removed, one primary root. A job id is used once across stages.
+ * The qualification's tree must equal the dispatched commit's tree. Returns the verified summary the admission receipt records.
+ */
+export function verifyQualificationReceipts(text, { sha, git }) {
+  let q;
+  try { q = JSON.parse(text); } catch { refuse("the qualification input is not JSON"); }
+  const tree = String(git("rev-parse", `${sha}^{tree}`)).trim();
+  requireThat(/^[0-9a-f]{40}$/.test(tree), `cannot read the tree of ${sha.slice(0, 12)}`);
+  requireThat(q?.tree === tree, `the qualification receipt is for tree ${String(q?.tree).slice(0, 12)}, the dispatched commit's tree is ${tree.slice(0, 12)}`);
+  requireThat(typeof q.unit?.kind === "string" && typeof q.unit?.name === "string", "the qualification receipt names no unit");
+  const pins = enrolledPins(sha, git);
+  const unit = `${q.unit.kind}:${q.unit.name}`;
+  // What each stage's signed requests must show, derived by the stages' own command builders from the dispatched commit's files.
+  const expectedByPlatform = new Map();
+  const expectedFor = (platform) => {
+    if (!expectedByPlatform.has(platform)) {
+      let expected;
+      try {
+        const config = JSON.parse(git("show", `${sha}:ci/gate.config.json`));
+        const manifest = q.unit.kind === "npm" ? JSON.parse(git("show", `${sha}:packages/${q.unit.name.slice("@rightkit/".length)}/package.json`)) : undefined;
+        expected = expectedStageCommands({ kind: q.unit.kind, unit: q.unit.name, config, manifest, platform });
+      } catch (error) { refuse(`cannot derive the ${platform} stage commands of ${unit} at ${sha.slice(0, 12)}: ${error.message}`); }
+      expectedByPlatform.set(platform, expected);
+    }
+    return expectedByPlatform.get(platform);
+  };
+  let platform = null;
+  let primaryRoot = null, snapshotPath = null, handle = null;
+  const seen = new Set();
+  const verified = {};
+  for (const stage of ATTESTED_STAGES) {
+    const list = q.stages?.[stage]?.receipts;
+    requireThat(Array.isArray(list) && list.length >= 1, `the qualification receipt's ${stage} stage carries no signed broker receipts; an unauthenticated qualification admits nothing`);
+    requireThat(list.length <= MAX_VERIFIED_RECEIPTS, `the qualification receipt's ${stage} stage carries ${list.length} receipts (at most ${MAX_VERIFIED_RECEIPTS})`);
+    const stageNonce = qualificationNonce({ commit: sha, tree, unit, stage });
+    // The nonces a receipt may carry, before its row is known: every carried call (a Cargo call, and a pnpm adapter job, rightkit#1301 B8) the
+    // nonce derived for the directory of each of the stage's rows it could be and the argv it signed. The row it is assigned to (below) must
+    // then be the one that fits.
+    const nonceFor = (row, argv) => carriedCallNonce({ stageNonce, cwd: row.cwd ?? ".", argv });
+    // The stage nonce is always tried as well, so a job that is none of the stage's commands is refused for that (below), not for its nonce.
+    const candidateNonces = (host, request) => {
+      if ((request?.kind !== "cargo" && request?.kind !== "adapter") || !Array.isArray(request.requestedArgv)) return [stageNonce];
+      // A cargo row is told apart by its exact argv; an adapter row's argv can hold a scratch path (pack), so every adapter row is tried (a job
+      // of another adapter then reaches the command check below and is refused for that, not for its nonce).
+      const rows = expectedFor(host.platform)[stage].filter((row) => row.kind === request.kind && (row.kind === "adapter" || row.argvs.some((argv) => sameJson(argv, request.requestedArgv))));
+      return [...new Set([...rows.map((row) => nonceFor(row, request.requestedArgv)), stageNonce])];
+    };
+    const jobs = [];
+    const summaries = new Map();
+    list.forEach((receipt, index) => {
+      const where = `${stage} receipt ${index + 1}`;
+      requireThat(receipt && typeof receipt === "object" && typeof receipt.id === "string" && receipt.id, `${where} has no job id`);
+      requireThat(!seen.has(receipt.id), `${where}: job ${receipt.id} appears more than once in the qualification`);
+      seen.add(receipt.id);
+      const candidates = pins.filter((p) => p.host === receipt.provenance?.payload?.host);
+      requireThat(candidates.length > 0, `${where}: signed for host ${JSON.stringify(receipt.provenance?.payload?.host)}, which ci/rk-pipeline.json does not enroll`);
+      let payload, failure, pin;
+      for (const candidate of candidates) {
+        for (const nonce of candidateNonces(candidate, receipt.provenance?.payload?.request)) {
+          try { payload = verifyProvenance(receipt, candidate, { jobId: receipt.id, nonce }); pin = candidate; break; } catch (error) { if (!(error instanceof ProvenanceError)) throw error; failure = error; }
+        }
+        if (payload) break;
+      }
+      requireThat(payload, `${where} (job ${receipt.id}) does not verify against the enrolled pins at ${sha.slice(0, 12)}: ${failure?.code}: ${failure?.message}`);
+      requireThat(payload.result?.status === "SUCCEEDED" && payload.result.exitCode === 0, `${where} (job ${receipt.id}) did not succeed (${payload.result?.status}, exit ${payload.result?.exitCode})`);
+      requireThat(typeof payload.request?.workspace === "string" && payload.request.workspace !== "", `${where} (job ${receipt.id}) records no workspace`);
+      requireThat(SHA256_HEX.test(payload.requestDigest ?? ""), `${where} (job ${receipt.id}) carries no request digest`);
+      // The signed request must be one of this stage's own commands (kind, adapter and exact argv, as the stage's builders define them),
+      // run on the enrolled host: the same one for every receipt of the qualification.
+      platform ??= pin.platform;
+      requireThat(pin.platform === platform, `${where} (job ${receipt.id}) was signed by the ${pin.platform} host, another host than the qualification's other jobs (${platform})`);
+      // The signed snapshot evidence names the commit, tree and job and shows the snapshot held the tree throughout (the same pure
+      // function the gate applies to its own receipts), and one snapshot and one ownership handle carry every job of the qualification.
+      const evidence = payload.snapshotEvidence;
+      requireThat(isRecord(evidence), `${where} (job ${receipt.id}) carries no signed snapshotEvidence: it was not built as a snapshot request of the dispatched commit`);
+      try { verifySnapshotEvidenceIdentity(evidence, { commit: { sha, tree }, tree, jobId: receipt.id }); }
+      catch (error) { if (!(error instanceof SnapshotRequestError)) throw error; refuse(`${where} (job ${receipt.id}): ${error.message}`); }
+      // Each carried request signs its own sub-handle `<ownership-handle>#<n>`; the qualification's one ownership is the part before the `#`.
+      const path = evidence.snapshot?.path, owner = ownershipOfHandle(evidence.ownership?.handle);
+      requireThat(typeof path === "string" && path !== "" && typeof owner === "string" && owner !== "", `${where} (job ${receipt.id}) names no snapshot path or ownership handle`);
+      requireThat(snapshotPath === null || snapshotPath === path, `${where} (job ${receipt.id}) ran in the snapshot ${path}, another snapshot than the qualification's other jobs (${snapshotPath})`);
+      requireThat(handle === null || handle === owner, `${where} (job ${receipt.id}) was signed under ownership handle ${owner}, another than the qualification's other jobs (${handle})`);
+      snapshotPath = path; handle = owner;
+      jobs.push({ id: receipt.id, payload });
+      summaries.set(receipt.id, { jobId: receipt.id, host: payload.host, keyId: payload.keyId, requestDigest: payload.requestDigest, requestedArgv: payload.request.requestedArgv });
+    });
+    // EVERY command the stage runs must be covered by a verified receipt of its own job, and every receipt must be one of those commands.
+    const { assigned, unmatched, missing } = assignJobs(expectedFor(platform)[stage], jobs);
+    // Messages are formatted only on failure: on success there is no unmatched job or missing command to describe.
+    if (unmatched.length) requireThat(false, `${stage} job ${unmatched[0]} ran ${JSON.stringify(jobs.find((j) => j.id === unmatched[0])?.payload.request.requestedArgv)}, which is not (or no longer) a command of the ${stage} stage of ${unit}`);
+    if (missing.length) requireThat(false, `the qualification carries no signed receipt of the ${stage} stage's ${missing.length ? describeCommand(missing[0]) : ""} (${missing.length} of ${assigned.size + missing.length} required command(s) missing)`);
+    for (const job of jobs) {
+      const row = assigned.get(job.id);
+      const { workspace, workspaceRoot, requestedArgv } = job.payload.request;
+      // The nonce is the one this row's command owes: derived from the directory its row runs in and the argv it signed (a Cargo call or a pnpm job).
+      requireThat(job.payload.nonce === nonceFor(row, requestedArgv), `${stage} job ${job.id} carries a nonce that is not the one its command (${describeCommand(row)}) owes`);
+      // The primary root: the signed workspace without the directory of the row's command (a carried cargo call runs from its manifest's
+      // directory, a pnpm job at the root). Every job of the qualification must show the same one, and so must its workspaceRoot.
+      const root = rootOfWorkspace(workspace, row.cwd);
+      requireThat(root !== null, `${stage} job ${job.id} ran in ${workspace}, which is not the directory ${row.cwd} of a checkout`);
+      requireThat(workspaceRoot === undefined || rootOfWorkspace(workspaceRoot, row.cwd) === root, `${stage} job ${job.id} ran in ${workspace} with workspace root ${workspaceRoot}, not in one checkout`);
+      requireThat(primaryRoot === null || primaryRoot === root, `${stage} job ${job.id} ran in ${workspace}, another workspace than the qualification's other jobs (${primaryRoot})`);
+      primaryRoot = root;
+    }
+    verified[stage] = list.map((receipt) => summaries.get(receipt.id));
+  }
+  return verified;
+}

package/qualify-reuse.mjs

@@ -0,0 +1,38 @@
+// GB-14 (GATE 37/E11): the gate's own qualify record is a journal of the protected installed-QA receipt, never a coarser claim beside it. The record
+// carries the receipt's digest; reusing the record calls the EXISTING protected verifier (release-qa-receipt.mjs) over the exact current state, so a
+// changed policy, floor, check coverage, source, artifact hash or sealed byte invalidates it at once. No parallel qualification framework exists here.
+import fs from "node:fs";
+import { QaAdmissionError, assertInstalledQaAdmission, qaReceiptPath, readQaReceipt } from "./release-qa-receipt.mjs";
+
+const HEX64 = /^[0-9a-f]{64}$/;
+
+/** The digest of the installed-QA receipt the qualify stage just produced for `releaseId`, or null when none is readable. */
+export function installedQaReceiptDigest({ repoRoot, releaseId, platform, readReceipt = readQaReceipt }) {
+  const receipt = readReceipt(qaReceiptPath({ repoRoot, releaseId, platform, stage: "installed" }));
+  return receipt && HEX64.test(receipt.digest ?? "") ? receipt.digest : null;
+}
+
+/**
+ * Why a recorded qualify result no longer stands for the sealed bytes now, or null when it does. `verify` defaults to the existing protected admission
+ * (assertInstalledQaAdmission over the sealed manifest); it needs this host's receipt key, so a runner that has none (the trusted publisher, whose
+ * upload admission verifies the receipt itself) passes `verify: null` and is held to the digest equality and the manifest digest only.
+ */
+export function qualifyReuseProblem({ recorded, sealedNow, repoRoot, platform, configName, verify = defaultVerify, readFile = (f) => fs.readFileSync(f, "utf8") }) {
+  if (!recorded?.ok) return "no passed qualify result is recorded";
+  if (!sealedNow || recorded.manifestSha256 !== sealedNow.digest) return "the sealed bytes differ from the ones qualified";
+  if (!HEX64.test(recorded.qaReceiptDigest ?? "")) return "the qualify record carries no protected QA receipt digest";
+  if (verify === null) return null;
+  try {
+    const admitted = verify({ repoRoot, sealedNow, platform, configName, readFile });
+    if (admitted?.digest !== recorded.qaReceiptDigest) return "the protected QA receipt on disk is not the one the qualify record names";
+  } catch (error) {
+    if (error instanceof QaAdmissionError) return `the protected installed-QA receipt no longer verifies: ${error.message}`;
+    return `the protected installed-QA receipt could not be verified: ${error.message}`;
+  }
+  return null;
+}
+
+function defaultVerify({ repoRoot, sealedNow, platform, configName, readFile }) {
+  const manifest = JSON.parse(readFile(sealedNow.manifest));
+  return assertInstalledQaAdmission({ repoRoot, manifest, platform, configName });
+}

package/recipe-build.mjs

@@ -32,8 +32,10 @@ import { existsSync as nodeExistsSync, readFileSync, readdirSync as nodeReaddirS
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { spawnSync as nodeSpawnSync } from "./background-process.mjs";
+import { buildLaunch } from "./build-launch.mjs";
 import { resolveTargetRoot as cargoResolveTargetRoot } from "./cargo-target.mjs";
 import { buildAndEmbedNativeHelpers, validateNativeHelpers } from "./native-helpers.mjs";
+import { lockedTauriArgs } from "./tauri-locked.mjs";
 import { assertTargetDirUnchanged, removeFreshSources, stageArtifacts, verifySameContent } from "./managed-target-stage.mjs";
 
 export const RECIPE_BUILD_PLAN_VERSION = 1;
@@ -382,7 +384,7 @@ export function waitForStableArtifacts(stability, { appRoot, log = () => {}, sta
  * nothing after it runs.
  * Options: appRoot (absolute), env, platform, log, spawnSync, fs, sleep, now, statSync (injected in tests).
  */
-export function runRecipeBuild(rawPlan, { appRoot, env = process.env, platform = process.platform, log = () => {}, spawnSync = nodeSpawnSync, fs, sleep, now, statSync, resolveTargetRoot = cargoResolveTargetRoot } = {}) {
+export function runRecipeBuild(rawPlan, { appRoot, env = process.env, platform = process.platform, log = () => {}, spawnSync = nodeSpawnSync, fs, sleep, now, statSync, resolveTargetRoot = cargoResolveTargetRoot, door = buildLaunch } = {}) {
   if (typeof appRoot !== "string" || !path.isAbsolute(appRoot)) fail("RECIPE_BUILD_PLAN_INVALID", "appRoot must be an absolute path");
   const plan = validateRecipePlan(rawPlan);
   const done = [];
@@ -403,10 +405,21 @@ export function runRecipeBuild(rawPlan, { appRoot, env = process.env, platform =
       verifyReal("after the copy-back, before the build step");
     }
     if (step.phase === "build" && plan.verifySidecars) verifyUniversalSidecars(plan.verifySidecars, { appRoot, spawnSync, env, log, ...(fs?.readFileSync ? { readFile: fs.readFileSync } : {}) });
-    const launch = resolveLaunch({ cmd: step.cmd, args: step.args, platform, env });
+    const stepArgs = lockedTauriArgs(step.args, env);
+    const launch = resolveLaunch({ cmd: step.cmd, args: stepArgs, platform, env });
     const cwd = path.resolve(appRoot, step.cwd ?? ".");
+    const stepEnv = { ...env, ...(step.env ?? {}) };
     log(`recipe-build: [${step.phase}] ${step.cmd} ${step.args.join(" ")}`.trimEnd());
-    const result = spawnSync(launch.command, launch.args, { cwd, env: { ...env, ...(step.env ?? {}) }, stdio: "inherit", shell: launch.shell, windowsHide: true });
+    // The release stage goes through the same one door as dev and test (build-launch.mjs; rightkit#1301, one model): on a broker host a pnpm,
+    // node or cargo step is a broker job (in a snapshot stage a carried one, with the Tauri CLI's compiles nested under it), a snapshot stage's
+    // `install` step is skipped, and this package's own right-release runs as it is. Where the door adds nothing (a direct host, a step it
+    // passes through unchanged) the step runs as resolveLaunch decided.
+    const own = launch.command === process.execPath && launch.args[0] === OWN_RIGHT_RELEASE;
+    const routed = own ? null : door(step.cmd, stepArgs, { env: stepEnv, stepEnv: step.env, platform, cwd, exists: (fs?.existsSync ?? nodeExistsSync) });
+    if (routed?.signingEnvDropped?.length) log(`recipe-build: ${routed.signingEnvDropped.join(", ")} suppresses signing in a direct session and is not forwarded to the broker (GB-06: signing material never rides an adapter request); this carried step runs unsigned and the seal is made outside the broker`);
+    const passthrough = !routed || (routed.command === step.cmd && routed.args.length === stepArgs.length && routed.args.every((a, i) => a === stepArgs[i]));
+    const run = passthrough ? launch : { command: routed.command, args: routed.args, shell: false };
+    const result = spawnSync(run.command, run.args, { cwd, env: { ...stepEnv, ...(!passthrough && routed.env ? routed.env : {}) }, stdio: "inherit", shell: run.shell, windowsHide: true });
     if (result?.error || result?.status !== 0) {
       fail("RECIPE_BUILD_STEP_FAILED", `recipe-build ${step.phase} step ${index} (${step.cmd}) failed (${result?.error?.message ?? `exit ${result?.status ?? result?.signal ?? "unknown"}`}); later steps were not run`, { phase: step.phase, index, cmd: step.cmd, status: result?.status ?? null });
     }